Poll: linuxulator Removal

Submitted by Shawn Webb on

Body: 

The linuxulator (the Linux emulation/translation layer in FreeBSD) has recently undergone a major overhaul. Many of FreeBSD's userbase relies on the linuxulator to provide things like the Adobe Flash Player browser plugin, linux browsers, and certain linux-centric tasks. The linuxulator provides a set of security challenges. It is yet another attack vector. The core HardenedBSD team would like to completely remove the linuxulator from HardenedBSD's codebase.

What would be removed:

  1. linuxulator and its dependents
  2. linprocfs (pending investigation, this might not be removed)
  3. packages that require the linuxulator

Should the linuxulator be removed?

Yes
66% (133 votes)
No
34% (70 votes)
Total votes: 203

HardenedBSD Backport to 10-STABLE

Submitted by Shawn Webb on

We mostly finished the backport of our 11-CURRENT patches to 10-STABLE this week. This means that those who have a preference not to use 11-CURRENT (and we don't blame them) can now have the comfort of having exploit mitigation features in a more stable branch. The backport is currently in an experimental branch (hardened/experimental/10-stable) but will be promoted to a stable branch (hardened/10-stable/master) in around a month if we deem it to be stable. We will soon be providing amd64 packages as well.

Introducing NoExec

Submitted by Shawn Webb on

Over the past few months, Oliver has been busy writing a new exploit mitigation feature for HardenedBSD: NoExec. The first part of this project was merged into master tree, and there are still ongoing issues to solve. Our implementation is inspired by PaX's. NoExec prevents pages that are marked as writable from being marked executable as well.

Pages

Subscribe to HardenedBSD RSS